CVE-2020-11023

Potential XSS vulnerability in jQuery

View on CVE.org
Published Apr 29, 2020 CVSS 3.1 · 6.9 Medium EPSS 84.9% KEV · Listed
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2608-1 jquery security update
Debian DLA Debian DLA DLA-3551-1 otrs2 security update
Debian DSA Debian DSA DSA-4693-1 drupal7 security update
Github GHSA Github GHSA GHSA-jpcq-cgw6-v4j6 Potential XSS vulnerability in jQuery
Ubuntu USN Ubuntu USN USN-7246-1 jQuery vulnerabilities
Ubuntu USN Ubuntu USN USN-7622-1 jQuery vulnerabilities
Ubuntu USN Ubuntu USN USN-7658-1 Drupal vulnerabilities
References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html cve-icon cve-icon
http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html cve-icon cve-icon
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released cve-icon cve-icon
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ cve-icon
https://github.com/github/advisory-database/blob/99afa6fdeaf5d1d23e1021ff915a5e5dbc82c1f1/advisories/github-reviewed/2020/04/GHSA-jpcq-cgw6-v4j6/GHSA-jpcq-cgw6-v4j6.json#L20-L37 cve-icon
https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 cve-icon cve-icon
https://jquery.com/upgrade-guide/3.5/ cve-icon cve-icon
https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-11023 cve-icon
https://security.gentoo.org/glsa/202007-03 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20200511-0006/ cve-icon cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-11023 cve-icon
https://www.debian.org/security/2020/dsa-4693 cve-icon cve-icon
https://www.drupal.org/sa-core-2020-002 cve-icon cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
https://www.tenable.com/security/tns-2021-02 cve-icon cve-icon
https://www.tenable.com/security/tns-2021-10 cve-icon cve-icon
History
Type Values Removed Values Added
First Time appeared Redhat quay
CPEs cpe:/a:redhat:quay:3::el8
Vendors & Products Redhat quay
Type Values Removed Values Added
First Time appeared Netapp active Iq Unified Manager
Netapp cloud Backup
Netapp cloud Insights Storage Workload Security Agent
Netapp hci Baseboard Management Controller
Oracle blockchain Platform
CPEs cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:21.1.2:*:*:*:*:*:*:*
Vendors & Products Netapp active Iq Unified Manager
Netapp cloud Backup
Netapp cloud Insights Storage Workload Security Agent
Netapp hci Baseboard Management Controller
Oracle blockchain Platform
Type Values Removed Values Added
First Time appeared Redhat logging
CPEs cpe:/a:redhat:logging:5.8::el8
Vendors & Products Redhat logging
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9
Type Values Removed Values Added
First Time appeared Redhat discovery
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:openstack:16.2::el8
cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:8.8::crb
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.2::crb
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_eus:9.4::crb
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
cpe:/o:redhat:discovery:1.0::el9
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:rhel_aus:7.7
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat discovery
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
References
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2025-01-23'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Earlier changes (6)

Subscriptions

Debian Debian Linux
Drupal Drupal
Fedoraproject Fedora
Jquery Jquery
Netapp Active Iq Unified Manager Cloud Backup Cloud Insights Storage Workload Security Agent H300e H300e Firmware H300s H300s Firmware H410c H410c Firmware H410s H410s Firmware H500e H500e Firmware H500s H500s Firmware H700e H700e Firmware H700s H700s Firmware Hci Baseboard Management Controller Max Data Oncommand Insight Oncommand System Manager Snap Creator Framework Snapcenter Server
Oracle Application Express Application Testing Suite Banking Enterprise Collections Banking Platform Blockchain Platform Business Intelligence Communications Analytics Communications Eagle Application Processor Communications Element Manager Communications Interactive Session Recorder Communications Operations Monitor Communications Services Gatekeeper Communications Session Report Manager Communications Session Route Manager Financial Services Regulatory Reporting For De Nederlandsche Bank Financial Services Revenue Management And Billing Analytics Health Sciences Inform Healthcare Translational Research Hyperion Financial Reporting Jd Edwards Enterpriseone Orchestrator Jd Edwards Enterpriseone Tools Oss Support Tools Peoplesoft Enterprise Human Capital Management Resources Primavera Gateway Rest Data Services Siebel Mobile Storagetek Acsls Storagetek Tape Analytics Sw Tool Webcenter Sites Weblogic Server
Redhat Amq Interconnect Ansible Tower Discovery Enterprise Linux Jboss Enterprise Application Platform Jboss Single Sign On Logging Openshift Openstack Quay Red Hat Single Sign On Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Tus Rhev Manager Service Mesh
Tenable Log Correlation Engine
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Oct 21, 2025, 11:35 PM
Reserved
Mar 30, 2020, 12:00 AM

View source JSON

Updated
Jan 23, 2025, 9:07 PM

JSON

Status
Analyzed
Published
Apr 29, 2020, 9:15 PM
Modified
Jun 17, 2026, 2:48 AM

View source JSON

Severity
Moderate
Public date
Apr 29, 2020, 12:00 AM

View source Bugzilla JSON

No data.